anubis | 1e1489deadd613d8a0ef3477d4a113b6680f91f0023f5daf39400900144743aa

Analysis

max time kernel
3866552s
max time network
162s
platform
android_x64
resource
android-x64-20220310-en
submitted
21-05-2022 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e1489deadd613d8a0ef3477d4a113b6680f91f0023f5daf39400900144743aa.apk
Size

3.2MB
MD5

b40df30630f5c633fe87ee5a185be1d1
SHA1

9e3f94ebec0cb4dafe8c97dfa45f41abcfde55a2
SHA256

1e1489deadd613d8a0ef3477d4a113b6680f91f0023f5daf39400900144743aa
SHA512

3faa34c838ec964e0251d62fd42fb4dd97f9c1790d97a3b0340c652abbbd4ba9b0ff7d40c877f06a33bb96b98e62f0d8afdf75d49dc5f6e857640ec9124162c7

Score

10^/10

anubis banker evasion infostealer trojan

Malware Config

Signatures

Anubis banker
Android banker that uses overlays.
banker trojan infostealer anubis

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz

ioc	pid	process
/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/MtAhQy.json	6262	wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz
/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/MtAhQy.json	6262	wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz

Reads information about phone network operator.
Listens for changes in the sensor environment (might be used to detect emulation). 1 IoCs
evasion

Processes:

wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz

description ioc process

Framework API call android.hardware.SensorManager.registerListener wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz

description	ioc	process
Framework API call	android.hardware.SensorManager.registerListener	wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz

wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz
1⤵
- Loads dropped Dex/Jar
- Listens for changes in the sensor environment (might be used to detect emulation).
PID:6262

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/MtAhQy.json

Filesize
2.0MB

MD5
54ac946b9f240236a85f48726d9bd82e

SHA1
571f48f3fe6a08e3b67221a80f8693c76dc0003b

SHA256
1f4210c5e60e4f95ea4f36d3d1ad6881ecec25341962d6477d1ab0238aa86080

SHA512
4051064c2903d1a27bf217bcfe73e4cab5a648afcff0020bd02e3876a3342073c25f1faeda96bd4b2c0f97ad1fd406516efa249ce427ad1cd5ff72d3c5b554c1

Download Submit
/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/MtAhQy.json

Filesize
2.0MB

MD5
0e638a36501717f15d6431022b4980c3

SHA1
920ffaeee3807d5cb607e7ec3bd11648ead78128

SHA256
e39ebb324970b3e03a4c4de00710e83020ed20a8286a534402d1ec5109c2172b

SHA512
ff20964036a0acf6e72516fd9a6eac1649b87a707401909c6affdf0647aaf789a894378f7d5d75abd3d69fa6527c14786bad04bfdc497693e95d78ee05fc1f11

Download Submit
/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/MtAhQy.json

Filesize
2.0MB

MD5
0e638a36501717f15d6431022b4980c3

SHA1
920ffaeee3807d5cb607e7ec3bd11648ead78128

SHA256
e39ebb324970b3e03a4c4de00710e83020ed20a8286a534402d1ec5109c2172b

SHA512
ff20964036a0acf6e72516fd9a6eac1649b87a707401909c6affdf0647aaf789a894378f7d5d75abd3d69fa6527c14786bad04bfdc497693e95d78ee05fc1f11

Download Submit
/data/user/0/wwkjda.puczhr.pgoflnmyeneoyyaawlkzmxfwfz/app_DynamicOptDex/oat/MtAhQy.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit